How to add a calculated values as threshold in a line chart?

[anooshac]

Hi everyone,

 I have a line chart of some tasks and its duration. I am trying to add average of the duration of all tasks as threshold.

|stats values(duration) as "Duration(Hr)" by Task|sort Task|stats avg(duration) as threshold

I am not getting any results from the query.I have previously added threshold as a fixed value. Is there any different method to add a threshold value which is calculated not fixed.

[ITWhisperer · Accepted solution]

Use eventstats

|stats values(duration) as "Duration(Hr)" by Task|sort Task|eventstats avg('Duration(Hr)') as threshold

[anooshac]

Thanks!! It is working. Does the aggregate function only work with eventstats?

[ITWhisperer]

No, the aggregate function works for all the stats and chart commands, eventstats adds the field to the events in the pipeline, whereas stats replaces the events in the pipeline

[anooshac]

Thank you so much for the info.

Can you please suggest any resources which will help in increasing the Splunk knowledge..

[ITWhisperer]

Splunk provide various training and certification opportunities

Splunk Training & Certification | Splunk

You can also download and setup trail instances to try things out.

You could look through the answers provided here and other community channels to see how other people have approached various problems.

[anooshac]

Sure..Thank you so much for the info!!